Switch to the simplified pricing tiers for Microsoft Sentinel

For many Microsoft Sentinel workspaces created before July 2023, there is a separate pricing tier for Azure Monitor Log Analytics in addition to the classic pricing tier for Microsoft Sentinel. To combine the data ingestion costs for Log Analytics and the data analysis costs of Microsoft Sentinel, enroll your workspace in a simplified pricing tier.


  • The Log Analytics workspace pricing tier must be on Pay-as-You-Go or a commitment tier before enrolling in a simplified pricing tier. Log Analytics legacy pricing tiers are not supported.
  • Sentinel must have been enabled prior to July 2023. Workspaces that enabled Sentinel July 2023 and onwards are automatically defaulted to the simplified pricing experience.
  • Microsoft Sentinel Contributor role is required to switch pricing tiers.

Change pricing tier to simplified

Classic pricing tiers are when Microsoft Sentinel and Log Analytics pricing tiers are configured separately and show up as different meters on your invoice. To move to the simplified pricing tier where Microsoft Sentinel and Log Analytics billing are combined for the same pricing meter, Switch to new pricing.

Use the following steps to change the pricing tier of your workspace using the Microsoft Sentinel portal. Once you've made the switch, reverting back to a classic pricing tier can't be performed using this interface.

  1. From the Settings menu, select Switch to new pricing.

    Screenshot showing setting option to switch to new pricing tier.

  2. Review your current tiers and consider the Recommended tier where there's a mismatch in tiers.

  3. Choose a selection from the Unified pricing tiers pull-down menu based on your typical ingestion.

  4. Select Ok to confirm.

Simplified pricing tiers for dedicated clusters

In classic pricing tiers, Microsoft Sentinel was always billed as a secondary meter at the workspace level. The meter for Microsoft Sentinel could differ from that of the workspace.

With simplified pricing tiers, the same Commitment Tier used by the cluster is set for the Microsoft Sentinel workspace. Microsoft Sentinel usage will be billed at the effective per GB price of that tier meter, and all usage is counted towards the total allocation for the dedicated cluster. This allocation is either at the cluster level or proportionately at the workspace level depending on the billing mode of the cluster. For more information, see Cost details - Dedicated cluster.

Offboarding behavior

If Microsoft Sentinel is removed from a workspace while simplified pricing is enabled, the Log Analytics workspace defaults to the pricing tier that was configured. For example, if the simplified pricing was configured for 100 GB/day commitment tier in Microsoft Sentinel, the pricing tier of the Log Analytics workspace changes to 100 GB/day commitment tier once Microsoft Sentinel is removed from the workspace.

Will switching reduce my costs?

Though the goal of the experience is to merely simplify the pricing and cost management experience without impacting actual costs, two primary scenarios exist for a cost reduction when switching to a simplified pricing tier.

  • The combined Defender for Servers benefit will result in a total cost savings if utilized by the workspace.
  • If one of the separate pricing tiers for Log Analytics or Microsoft Sentinel was inappropriately mismatched, the simplified pricing tier could result in cost saving.

Is there ever a reason NOT to switch?

It's possible your Microsoft account team has negotiated a discounted price for Log Analytics or Microsoft Sentinel charges on the classic tiers. You won't be able to tell if this is the case from the Microsoft Sentinel pricing interface alone. It might be possible to calculate the expected cost vs. actual charge in Microsoft Cost Management to see if there's a discount included. In such cases, we recommend contacting your Microsoft account team if you want to switch to the simplified pricing tiers or have any questions.

Next steps